CVE-2026-42147: Coolify SSRF Vulnerability

CVE-2026-42147 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-42147 is a Server-Side Request Forgery (SSRF) vulnerability affecting Coolify versions prior to 4.0.0-beta.474. The S3 storage endpoint validation only checks URL format, and the testConnection() method sends a server-side request to the configured endpoint. An authenticated user with storage management permissions can force Coolify to issue requests to internal services or cloud metadata endpoints. The issue is categorized under CWE-918 and is fixed in version 4.0.0-beta.474.

Critical Impact
Authenticated attackers with storage management privileges can pivot to reach internal services and cloud instance metadata endpoints, potentially exposing credentials and infrastructure secrets.

Affected Products

Coolify versions prior to 4.0.0-beta.474
Self-hosted Coolify instances exposing S3 storage configuration
Deployments running on cloud providers with metadata services (AWS IMDS, GCP, Azure)

Discovery Timeline

2026-07-07 - CVE-2026-42147 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42147

Vulnerability Analysis

The vulnerability lives in Coolify's S3 storage configuration workflow. When an operator adds or edits an S3 storage backend, Coolify accepts an arbitrary endpoint URL and validates only its syntactic format. The testConnection() routine then issues a server-side HTTP request from the Coolify host to that endpoint. Because no allow-list, scheme restriction, or IP filtering is applied, the request can target 127.0.0.1, RFC1918 addresses, or the cloud metadata endpoint at 169.254.169.254. This gives an authenticated attacker with storage permissions a primitive to probe internal networks and read metadata service responses through Coolify.

Root Cause

Input validation on S3 endpoint URLs was limited to format checking. The application did not enforce a URL safety rule to block loopback, private, link-local, or metadata IP ranges before calling the outbound request. As a result, any well-formed URL passed validation regardless of destination.

Attack Vector

An authenticated user with storage management permissions submits a crafted S3 endpoint pointing at an internal target and triggers the connection test. Coolify performs the outbound request from its own network context and surfaces response indicators to the attacker. On cloud-hosted deployments, this can be used to reach instance metadata services and retrieve temporary credentials or configuration data.

php

// Security patch: tightened S3 endpoint URL validation
// File: app/Livewire/Storage/Create.php and app/Livewire/Storage/Form.php
 namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
+use App\Rules\SafeWebhookUrl;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;

Source: Coolify commit 297e9c41

The patch introduces the SafeWebhookUrl validation rule to both Create.php and Form.php in the storage Livewire components, rejecting endpoints that resolve to unsafe destinations before testConnection() executes.

Detection Methods for CVE-2026-42147

Indicators of Compromise

Outbound HTTP requests from the Coolify host to 169.254.169.254, 127.0.0.1, localhost, or internal RFC1918 addresses originating from the S3 test-connection code path.
S3 storage records in the Coolify database containing endpoint URLs that do not point to legitimate object storage providers.
Unusual audit log entries showing repeated storage creation or edit attempts by a single authenticated user.

Detection Strategies

Inspect Coolify application logs for testConnection() invocations tied to endpoints resolving to private or link-local IP space.
Monitor egress traffic from Coolify hosts and alert on connections to cloud metadata endpoints such as 169.254.169.254.
Review the S3 storage table for entries with loopback, private, or metadata-service hostnames.

Monitoring Recommendations

Enable web server and reverse proxy access logging for authenticated Coolify sessions performing storage configuration changes.
Correlate outbound network flows from the Coolify host with authenticated user activity in the application audit trail.
Alert on any HTTP 200 responses returned from metadata service IPs to the Coolify process.

How to Mitigate CVE-2026-42147

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.474 or later, which enforces the SafeWebhookUrl rule on S3 endpoints.
Audit existing S3 storage entries and remove any endpoints pointing to internal, loopback, or metadata addresses.
Rotate any cloud credentials or instance role tokens that may have been exposed via the metadata service.

Patch Information

The fix is delivered in Coolify v4.0.0-beta.474. The change is described in GHSA-pwm4-w33c-wjf3 and implemented in commit 297e9c41, which applies the SafeWebhookUrl validation rule to S3 endpoint inputs.

Workarounds

Restrict storage management permissions to a minimal set of trusted administrators until patching is complete.
Use host-level egress firewall rules to block Coolify outbound traffic to 169.254.169.254 and internal ranges not required for operation.
On AWS, enforce IMDSv2 with hop-limit 1 to prevent proxied metadata retrieval through the Coolify host.

bash

# Example: block metadata service egress from the Coolify host using iptables
sudo iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example: enforce IMDSv2 with a hop limit of 1 on the EC2 instance running Coolify
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled